H3C Technologies H3C SecPath F1000-E - Manual (Page 29)

21
Figure 21 Network diagram
Configuration considerations
To satisfy the requirements, perform the following configurations on the SecPath:
• Configure scanning detection for the untrusted zone, enable the function to add entries to the
blacklist, and set the scanning threshold to, for example, 4500 connections per second.
• Configure source IP address-based connection limit for the trusted zone, and set the number of
connections each host can initiate to, for example, 100.
• Configure destination IP address-based connection limit for the DMZ, and set the number of
connections the server can accommodate to, for example, 10000.
• Configure SYN flood detection for the DMZ, and set the action threshold for attacks targeting the
internal server (for example, to 5000 packets per second) and the silent threshold (for example, to
1000 packets per second). Set the attack protection action to blocking subsequent packets destined
for the server.
Configuration procedure
# Assign IP addresses to interfaces. (Details not shown.)
# Enable the blacklist feature.
From the navigation tree, select Intrusion Detection > Blacklist. The blacklist management page appears,
as shown in
Figure 22 .